Set MYSQL_ROOT_PASSWORD via Secret #253

lkpdn · 2018-11-20T04:33:25Z

For security reasons, we better to (a). factor out hard-coded mysql root password and use Secret instead + (b). set dynamically generated random password.

This change is

Signed-off-by: Koichiro Den <den@valinux.co.jp>

googlebot · 2018-11-20T04:33:28Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here (e.g. I signed it!) and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

k8s-ci-robot · 2018-11-20T04:33:38Z

Hi @lkpdn. Thanks for your PR.

I'm waiting for a kubeflow member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

YujiOshima · 2018-11-20T04:45:13Z

scripts/deploy.sh

+
+# Generate Secret with dynamically initialized data, so as to keep Go codebase
+# simple as possible i.e., without client-go ClientSet.
+cat <<EOF | kubectl create -f -


Please create a db-secret.yml not generating a key in deploy.sh.
The deploy.sh should be a simple support script.

Thanks for the comment. If we still keep the password randomised as my original patch does, I may choose either of:

(1). make it as a go template, add a lightweight cli tool to do template.Execute()

(2). choose a popular template engine, such as jinja2

Does the option (1) sound ok to you? If I misunderstood your point, please correct me.

Do we really need to randomize?
Why not to make secret manifest and set a default password. Then users will edit it when they need.

To be honest, I don't have any strong intention for randomization. I'll remove randomisation then push a commit tomorrow. The PR diff should be very simple and small one. Thanks. :)

lkpdn · 2018-11-20T22:39:27Z

To googlebot, abt. CLA:
I signed it!

googlebot · 2018-11-20T22:39:29Z

CLAs look good, thanks!

Signed-off-by: Koichiro Den <den@valinux.co.jp>

lkpdn · 2018-11-20T22:57:25Z

@YujiOshima please take another look.

YujiOshima · 2018-11-20T23:19:33Z

@lkpdn Thank you! It gets simple!
/ok-to-test

toshiiw · 2018-11-21T01:39:03Z

manifests/vizier/db/secret.yaml

+  name: vizier-db-secrets
+  namespace: katib
+data:
+  MYSQL_ROOT_PASSWORD: test


I think we should take a "secure by default" approach and the value should be randomized, while its implementation can be a bit messy. Also it has to be initialized before the mysql pod starts up.
At least there should be an issue so that we don't forget to randomize before GA. ;-)

IMHO editing manifest for the secret before running deploy.sh seems not much burden.

To do that, users must be aware of the secret.yaml file. Randomization must happen automatically or the majority of deployments would be in an insecure state.

I agree with your point "secure by default". How about dynamically generating manifests when executing ./scripts/build.sh, or introduce a new script, e.g. ./scripts/generate-manifests.sh? Other projects tend to have users do that sort of thing, such as $ make manifests. I think it's much better than doing it in ./scripts/deploy.sh

lkpdn · 2018-11-22T00:12:01Z

I'm just guessing but the test failure seems not relating to this PR. Looking into it...

YujiOshima · 2018-11-22T01:45:17Z

/retest

lkpdn · 2018-11-22T05:01:30Z

I realized that sed -i -e "31,37d" manifests/vizier/db/deployment.yaml in test/scripts/run-tests.sh had to be updated as well. I pushed a fix ~~f1ed1c1~~ b533db5. Please let me know if these should be fixed-up.

Fixes: 5312459 ("Set randomly generated MYSQL_ROOT_PASSWORD via Secret") Signed-off-by: Koichiro Den <den@valinux.co.jp>

YujiOshima · 2018-11-22T05:57:09Z

Great! Thank you!
/lgtm
/approve

k8s-ci-robot · 2018-11-22T05:57:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: YujiOshima

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [YujiOshima]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lkpdn · 2018-11-22T06:32:45Z

Thanks for reviewing.

Commit b6f8e07 ("Update manifests (kubeflow#246)") has just changed the namespace as a whole. This new manifest should be updated as well. Fixes: 67e94c7 ("Set MYSQL_ROOT_PASSWORD via Secret (kubeflow#253)") Signed-off-by: Koichiro Den <den@valinux.co.jp>

Fixes: 67e94c7 ("Set MYSQL_ROOT_PASSWORD via Secret (kubeflow#253)") Signed-off-by: Koichiro Den <den@valinux.co.jp>

Commit b6f8e07 ("Update manifests (#246)") has just changed the namespace as a whole. This new manifest should be updated as well. Fixes: 67e94c7 ("Set MYSQL_ROOT_PASSWORD via Secret (#253)") Signed-off-by: Koichiro Den <den@valinux.co.jp>

Fixes: 67e94c7 ("Set MYSQL_ROOT_PASSWORD via Secret (kubeflow#253)") Signed-off-by: Koichiro Den <den@valinux.co.jp>

* Add readinessProbe for vizier-db Signed-off-by: Koichiro Den <den@valinux.co.jp> * Fix MYSQL_ROOT_PASSWORD Fixes: 67e94c7 ("Set MYSQL_ROOT_PASSWORD via Secret (#253)") Signed-off-by: Koichiro Den <den@valinux.co.jp> * Add simple loop to wait for DB connection successfully opened Signed-off-by: Koichiro Den <den@valinux.co.jp>

Set randomly generated MYSQL_ROOT_PASSWORD via Secret

5312459

Signed-off-by: Koichiro Den <den@valinux.co.jp>

k8s-ci-robot requested review from jose5918 and libbyandhelen November 20, 2018 04:33

k8s-ci-robot added the size/M label Nov 20, 2018

k8s-ci-robot added the needs-ok-to-test label Nov 20, 2018

YujiOshima reviewed Nov 20, 2018

View reviewed changes

lkpdn changed the title ~~Set randomly generated MYSQL_ROOT_PASSWORD via Secret~~ Set MYSQL_ROOT_PASSWORD via Secret Nov 20, 2018

Seperate manifest for MYSQL_ROOT_PASSWORD, "test" being set by default

4cf4b9a

Signed-off-by: Koichiro Den <den@valinux.co.jp>

k8s-ci-robot added ok-to-test and removed needs-ok-to-test labels Nov 20, 2018

toshiiw reviewed Nov 21, 2018

View reviewed changes

Update run-tests.sh

b533db5

Fixes: 5312459 ("Set randomly generated MYSQL_ROOT_PASSWORD via Secret") Signed-off-by: Koichiro Den <den@valinux.co.jp>

lkpdn force-pushed the set-mysql-root-password-using-secret branch from f1ed1c1 to b533db5 Compare November 22, 2018 05:14

k8s-ci-robot assigned YujiOshima Nov 22, 2018

k8s-ci-robot added the lgtm label Nov 22, 2018

k8s-ci-robot added the approved label Nov 22, 2018

k8s-ci-robot merged commit 67e94c7 into kubeflow:master Nov 22, 2018

lkpdn deleted the set-mysql-root-password-using-secret branch November 22, 2018 06:32

lkpdn mentioned this pull request Nov 26, 2018

Fix incorrectly set namespace #260

Merged

lkpdn pushed a commit to lkpdn/katib that referenced this pull request Nov 26, 2018

Fix MYSQL_ROOT_PASSWORD

6c48274

Fixes: 67e94c7 ("Set MYSQL_ROOT_PASSWORD via Secret (kubeflow#253)") Signed-off-by: Koichiro Den <den@valinux.co.jp>

lkpdn pushed a commit to lkpdn/katib that referenced this pull request Nov 26, 2018

Fix MYSQL_ROOT_PASSWORD

7b0e898

Fixes: 67e94c7 ("Set MYSQL_ROOT_PASSWORD via Secret (kubeflow#253)") Signed-off-by: Koichiro Den <den@valinux.co.jp>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set MYSQL_ROOT_PASSWORD via Secret #253

Set MYSQL_ROOT_PASSWORD via Secret #253

lkpdn commented Nov 20, 2018 •

edited by jlewi

Loading

googlebot commented Nov 20, 2018

k8s-ci-robot commented Nov 20, 2018

YujiOshima Nov 20, 2018

lkpdn Nov 20, 2018

YujiOshima Nov 20, 2018

lkpdn Nov 20, 2018 •

edited

Loading

lkpdn commented Nov 20, 2018

googlebot commented Nov 20, 2018

lkpdn commented Nov 20, 2018

YujiOshima commented Nov 20, 2018

toshiiw Nov 21, 2018

lkpdn Nov 22, 2018

toshiiw Nov 22, 2018

lkpdn Nov 22, 2018

lkpdn commented Nov 22, 2018

YujiOshima commented Nov 22, 2018

lkpdn commented Nov 22, 2018 •

edited

Loading

YujiOshima commented Nov 22, 2018

k8s-ci-robot commented Nov 22, 2018

lkpdn commented Nov 22, 2018

Set MYSQL_ROOT_PASSWORD via Secret #253

Set MYSQL_ROOT_PASSWORD via Secret #253

Conversation

lkpdn commented Nov 20, 2018 • edited by jlewi Loading

googlebot commented Nov 20, 2018

What to do if you already signed the CLA

Individual signers

Corporate signers

k8s-ci-robot commented Nov 20, 2018

YujiOshima Nov 20, 2018

Choose a reason for hiding this comment

lkpdn Nov 20, 2018

Choose a reason for hiding this comment

YujiOshima Nov 20, 2018

Choose a reason for hiding this comment

lkpdn Nov 20, 2018 • edited Loading

Choose a reason for hiding this comment

lkpdn commented Nov 20, 2018

googlebot commented Nov 20, 2018

lkpdn commented Nov 20, 2018

YujiOshima commented Nov 20, 2018

toshiiw Nov 21, 2018

Choose a reason for hiding this comment

lkpdn Nov 22, 2018

Choose a reason for hiding this comment

toshiiw Nov 22, 2018

Choose a reason for hiding this comment

lkpdn Nov 22, 2018

Choose a reason for hiding this comment

lkpdn commented Nov 22, 2018

YujiOshima commented Nov 22, 2018

lkpdn commented Nov 22, 2018 • edited Loading

YujiOshima commented Nov 22, 2018

k8s-ci-robot commented Nov 22, 2018

lkpdn commented Nov 22, 2018

lkpdn commented Nov 20, 2018 •

edited by jlewi

Loading

lkpdn Nov 20, 2018 •

edited

Loading

lkpdn commented Nov 22, 2018 •

edited

Loading